Vishing campaign targets executives for Microsoft 365 data theft

Arctic Wolf has described a data-theft and extortion cluster targeting Microsoft 365 and other SaaS accounts through fraudulent IT-help-desk calls, adversary-in-the-middle login pages and residential-proxy session replay. The activity, tracked as PREY-0058, primarily targets executives and proceeds to SharePoint, Entra ID, OneDrive, Exchange and Box discovery before bulk collection and extortion. Arctic Wolf said the lure infrastructure includes hundreds of subdomains impersonating real companies.